> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests/supported-targets.md).

# Supported Targets

## Overview

The standard pentest workflow targets REST and GraphQL APIs. Server-side rendered HTML applications and single-page applications are evaluated by the Bug Hunt workflow rather than the standard pentest.

## Application Types

| Type                         | Supported            | Notes                                                                                                                                                                |
| ---------------------------- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **REST APIs**                | Yes                  | Full support with or without OpenAPI definitions.                                                                                                                    |
| **GraphQL APIs**             | Yes                  | Introspection, mutation testing, authorization matrix analysis.                                                                                                      |
| **SSR HTML Apps**            | Bug Hunt only / beta | Server-side rendered web apps (Django, Rails, Express, etc.) are assessed by the [Bug Hunt](/capabilities/bug-hunts.md) workflow, not the standard pentest workflow. |
| **SPAs**                     | Bug Hunt only / beta | Single-page apps (React, Vue, Angular) are assessed by the [Bug Hunt](/capabilities/bug-hunts.md) workflow, not the standard pentest workflow.                       |
| **SOAP APIs**                | Not yet              | Register interest with the Nullify team.                                                                                                                             |
| **WebSockets**               | Not yet              | Event-driven assessments are on the roadmap.                                                                                                                         |
| **gRPC**                     | Not yet              | Reach out if you would like to participate in design partners.                                                                                                       |
| **Custom TCP/UDP Protocols** | Not yet              | Custom protocol testing on the roadmap.                                                                                                                              |